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REMARKS 

The Examiner has again rejected Claims 20-50 under 35 U.S.C. 112, second 
paragraph, as being indefinite for failing to particularly point out and distinctively claim 
the subject matter which applicant regards as the invention. In particular, the Examiner 
again takes issue with applicant's claimed "reconstructing the session." In applicant's 
previous response, applicant argued that such terminology is sufficiently clear, in view of 
both the teachings of t he specification and the plain meaning of "reconstructing ." 
Evidence of the plain and ordinary meaning of the term "reconstructing" is found in the 
following dictionary definition. ' 

reconstruct 

1. To construct again; rebuild. 

2. To assemble or build again mentally; re-create: 
reconstructed the sequence of events from the evidence. 

3. To cause to adept a r.ew attitude or outlook: a diehard 
traditionalist who could not be reconstructed. 

The American Heritage© Dictionary of the English Language, Fourth 
Edition 

Copyright © 2000 by Houghton Mifflin Company. 

Published by Houghton Mifflin Company. All rights reserved. 

The Examiner has taken issue with the fact that applicant has relied on both the 
teachings of the specification and the plain meaning of "reconstructing." Further, the 
Examiner has stated that "reconstructing the session" "will be treated as the gathering of 
information about the session, and the analyzing of this gathered information in order to 
monitor or account a specific flow (session), or sets of flows (sessions), of network 
information."" 

Since such definition does not reflect the plain and ordinary meaning of the term 
'reconstruct 5 (as constrained by the specification and evidenced by the above exemplary 
definition), applicant respectfully disagrees with this interpretation. It appears that the 
Examiner is requesting an explicit specific definition of the phrase "reconstructing the 
session." To overcome the Examiner's concerns, such a definition is set forth as follows: 
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"reconstructing the session" is to be interpreted as an operation that "constructs 
again, rebuilds, and/or recreates (per the above definition) a session that comprises a 
plurality of flows which, in turn, comprise a plurality of packets, wherein the 
reconstruction is performed utilizing at least one application associated with the session." 

In view of the above definition, applicant thus argues that the present claim 
language is sufficiently clear and definite. 

The Examiner goes on to take issue with applicant's claimed "reconstructing the 
session utilizing the identified application at a plurality of collaborating nodes.*' 
Specifically, the Examiner starts by arguing that it is unclear how a single "identified 
application" is operated "at a plurality of collaborating nodes." In response, it appears the 
Examiner is misinterpreting such claim language. Applicant is not claiming "operating 
an identified application at a plurality of collaborating nodes," but rather reconstructing a 
session at a plurality of nodes. Applicant has amended the claims to make this clearer. 
The Examiner should note that the packets (that make up the flows that make up the 
session that is associated with an application) can traverse multiple (and possibly 
different) nodes during a communication session. Note Figure 6 of applicant's original 
specification. Thus, applicant's claim language is sufficiently clear and makes sense, 
contrary to the Examiner's related statements. 

The Examiner completes his 1 12 arguments by stating that that the claimed 
"hints" are unclear, and then interprets the "hints" to encompass any information about a 
packet. Again, applicant argues that such terminology is sufficiently clear, in view of 
both the teachings of the specification and the plain meaning of "hints." Evidence of the 
plain and ordinary meaning of the term "hint" is found in the following dictionary 
definition. 

hint 

1. A slight indication or intimation: wanted to avoid any **int 
of scandal. 

2. A brief or indirect suggestion; a tip: stock-tradir.g hints. 
Attorney Docket XACTPO 1 5B -9- 
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3. A statement conveying information in an indirect fashion; a 
clue: Give me a hint about tho big news. 

4. A barely perceptible amount: just a hint of color. 

The American Heritage® Dictionary of the English Lanouage, Fourth 
Edition 

Copyright © 2000 by Hcucthton Mifflin Company. 

Published by Houghton Mifflin Company. All rights reserved. 

Moreover, in response to the concerns of the Examiner, the applicant has amended 
the claims to more specifically define the hints, in the claims. Thus, this rejection is 
deemed to be adequately avoided. 

Claims 20-50 are rejected under 35 U.S.C. 103(a) as being unpatentable over Chiu 
et al. (U.S. Patent Number 5,101,402), hereinafter referred to as Chiu, in view of Ronen 
(U.S. Patent Number 5,845,267), hereinafter referred to as Ronen, further in view of 
Maccabee et al (U.S. Patent Number 6,108,700), hereinafter referred to as Maccabee. 
Stillyet, Claims 20-50 are further rejected under 35 U.S.C. 103(a) as being unpatentable 
over McCreery et al. (U.S. Patent Number 5,787,253), hereinafter referred to as 
McCreery, in view of Ronen (U.S. Patent Number 5,845,267), hereinafter referred to as 
Ronen. 

Applicant respectfully disagrees with such rejection, especially in view of the 
amendments made hereinabove. Since such amendments are similar to the dependent 
claims previously submitted, applicant purports that such amendment would not require 
further search and/or consideration. 

To establish a prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references themselves or 
in the knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) 
must teach or suggest all the claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
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prior art and not based on applicant's disclosure. In re Vaeck,947 F.2d 488, 20 USPQ2d 
1438 (Fed.Cir.1991). Applicant respectfully asserts that at least the first and third 
elements of the prima facie case of obviousness have not been met. 

With respect to the first element of the prima facie case of obviousness, the 
Examiner states that it would have been obvious to one of ordinary skill in the art at the 
time of the invention was made to modify Chiu and McCreery in view of the teachings of 
Ronen. Applicant respectfully disagrees with this proposition, especially in view of the 
vast evidence to the contrary. 

For example, the Examiner fails to cite specific motivation in the above references 
to support the case for combining the same. The Examiner is reminded that the Federal 
Circuit requires that there must be some logical reason apparent from the evidence of 
record that would justify the combination or modification of references. In re Regel, 188 
USPQ !32(CCPA 1975). 

Further, Chiu and McCreery relates to systems for monitoring and analyzing 
network activity, while Ronen relates to a billing system . To simply glean features from a 
billing system, such as that of Ronen, and combine the same with the non-analogous art 
of systems for monito ring and analyzing network activities , such as those of Chiu and 
McCreery would simply be improper. Billing systems bill for activity, while systems for 
monitorin g and analyzing network activity monitor network performance. "In order to 
rely on a reference as a basis for rejection of an applicant's invention, the reference must 
either be in the field of applicant's endeavor or, if not, then be reasonably pertinent to the 
particular problem with which the inventor was concerned." In re Oetiker, 977 F.2d 1443, 
1446, 24 USPQ2d 1443, 1445 (Fed. Cir, 1992). See also In re Deminski, 796 F.2d 436, 
230 USPQ 313 (Fed. Cir. 1986); In re Clay, 966 F.2d 656, 659, 23 USPQ2d 1058, 1060- 
61 (Fed. Cir. 1992) In view of the vastly different types of problems a billing system 
addresses as opposed to systems for monitoring and analyzing network activity , the 
Examiner's proposed combination is inappropriate. 
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With respect to the third element of the prima facie case of obviousness, the 
Examiner has amended his previous action to cite the following additional excerpts from 
Chiu and McCreery to meet applicant's claimed "reconstructing the session utilizing the 
identified application at a plurality of collaborating nodes " (emphasis added - see all of 
the independent claims). 



A second preferred embodiment of the present invention is embodied 
in a plurality of copies of a software program, each copy 
executing on a node in separate port icn of an Ethernet WAN, such 
as the network of FIG . 4. Each node executing the software program 
is operated in promiscuous mode. 

Because each copy of tho software program executes on a node in a 
separate portion of the network, each node will "see" a different 
set of packets. For example, referring to FIG. 4, a copy of the 
software program of the present invention executing on node D will 
never see packets sent from node A to node C because node C is on 
the other side of the router from node D. Neither will node D see 
packets multicast from node A, since multicast packets are not 
forwarded across routers. In contrast, a copy of the software 
program of the present Invention executing on node B will see both 
packets sent from node A to node C {since node B is on the same 
side of the bridge as is node C) and packets multicast from node 
A . 

Each of the plurality oi: software programs of the second preferred 
embodiment collects session information from the packets that it 
"sees" in a manner simi.ar to the manner employed by the software 
program of the first preferred embodiment described in FIGS. 5-15. 
In addition, however, the software programs send the collected 
information to a centra, node upon receiving an information 
request from the centra node . 

The central node correlates the collected information received 
from the various nodes. For example, in FIG. 4, since both node C 
and node D "see" packets sent from node B to node E, both node C 
and node D will collect session information from those packets. 
The collector node contains a software proqram to eliminate this 
duplication of collected information from the global collected 
data, such as- the total. sub.-- sessions . sub. -- attempted field. 
The collector node also recognizes duplications of single session 
information. For example, in the example above where information 
concerning packets sent from node B to node Z is collected by both 
nodes C and D, only one set of collected information will 
ultimately be retained by the collector node," (see col. 11, line 
55 - col. 12, line 28 from Chiu) 

"Additionally, a plurality of internet activity analyzers 30C may 
be connected to network segments to access more comprehensive 
information . Although the internet activity analyzer 300 is 
primarily intended for analyzing internet activity, including that 
on the Internet, is understood that the analyzer 300 may be used 
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to monitor any network, including a local area network (LANS if 
desired." (see col. 6, lines 41-43 of McCreery) 

With respect to Chiu, such reference merely suggests different software programs 
on different nodes that send information to a central component Moreover, McCreery 
merely suggests multiple analyzers. Neither reference even suggests "reconstructing the 
session utilizing the identified application, the session reconstruction being carried out at 
a plurality of collaborating nodes/' (see all of the independent claims, as clarified). 

Only applicant teaches and claims multiple nodes that both perform the claimed 
reconstruction AND collaborate with respect to such reconstruction, as claimed. For 
example, Chiu's nodes just gather and do not reconstruct and certainly do not collaborate 
with each other in such regard. Moreover, McCreery's analyzers do not reconstruct, as 
specifically claimed, and do not collaborate, as claimed. 

It appears that the Examiner has not taken into consideration the full weight of 
applicant's claims, as highlighted by the discussion above regarding the interpretation 
issues. Applicant respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met, since the prior art references, when combined, fail 
to teach or suggest all of the claim limitations, as noted above. A notice of allowance or a 
specific prior art showing of all of applicant's claim limitations, in combination with the 
remaining claim elements, is respectfully requested. 

Nevertheless, in the spirit of expediting the prosecution of the present application 
and bringing this manner to a conclusion, applicant has amended each of the independent 
claims to include the following subject matter: 

"wherein the session reconstruction is performed at a first analyzer, and 

upon a successful session reconstruction on the first analyzer, a first 
message is sent to at least one second analyzer separate from the first analyzer, the 
first message corresponding to session data, and 

Attorney Docket XACTPO 1 5B -13- 
page 16/20 * RCVD AT 12/8/2004 12:53:57 PM [Eastern Standard Time] * SVR:USPTO-EFXRF-1/0 * DNIS:8729306 * CSID:408 971 4660 * DURATION (mm-ss):07-04 



Dec 08 04 10:05a SVIPG 



408 971 4660 



upon an unsuccessful session reconstruction on the first analyzer, one or 
more messages is sent to the second analyzer, the one or more messages including 
unrecognized data." 

Thus, the specific details regarding the collaboration amongst the nodes during 
session reconstruction is now explicitly set forth. Again, a notice of allowance or a 
specific prior art showing of all of applicant's claim limitations, in combination with the 
remaining claim elements, is respectfully requested. 

The Examiner continues by rejecting Claims 20-50 under 35 U.S.C. 103(a) as 
being unpatentable over "Rich Data About Customer Usage" (Narus' semantic traffic 
analysis), written by Bill Roberts for Internet World, v5, nlO, p27, published 3/15/1999, 
in view of "Narus and Portal Join to Provide Internet service Providers Full Customer 
Management and Billing Solutions; Alliance creates Solution Suites for ISPs to Build 
Service-Driven Businesses", Business Wire, 3/16/999. Applicant's invention was 
completed in the United States at a date prior to March 15, 1999, the effective date of the 
above reference that was cited by the Examiner. A declaration and evidence of such was 
previously submitted herewith. 

In his latest action, the Examiner argues that the submitted evidence is not 
enabling and fails to show sufficient details regarding conception and reduction to 
practice. The only specific allegation the Examiner makes is that "[t]he operation of the 
invention at a plurality of collaborating nodes and the coordination of multiple agents 
within the system is never discussed." Applicant respectfully disagrees with this 
assertion. On page 1 of Exhibit A, "distributed" operation is clearly set forth. 

It appears that the Examiner has rejected applicant's previous submission based 
solely on the content of the exhibit. The Examiner is reminded that the exhibit must be 
considered in combination with the affidavit. Applicant purports, that by doing so, the 
previously submission is adequate for overcoming the Narus reference. 
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Even if the Examiner's assertion were to be correct, the Narus reference 
inadequately meets the prime face case, since the prior art reference fails to teach or 
suggest all of the claim limitations. Specifically, the following claim limitations are not 
met: 

"reconstructing the session utilizing the identified application, the session 
reconstruction being carried out at a plurality of collaborating nodes" 

"wherein the session reconstruction is performed at a first analyzer, and 

upon a successful session reconstruction on the first analyzer, a first 

message is sent to at least one second analyzer separate from the first analyzer, the 

first message corresponding to session data, and 

upon an unsuccessful session reconstruction on the first analyzer, one or 

more messages is sent to the second analyzer, the one or more messages including 

unrecognized data," 

With respect to the previously added dependent claims, applicant has carefully 
reviewed the excerpts relied upon by Ihe Examiner to reject the same, and has found 
serious deficiencies in the Examiner's application of the prior art. Highlighted below are 
claimed features that are clearly not even suggested by the Examiner's proposed 
combination(s): 

"a first flow associated with a first application flows through a first one of the 
nodes." (see Claim 41) 

"a second flow associated with the first application flows through a second one of 
the nodes." (see Claim 42) 

"each of the collaborating nodes includes a packet source and a first hierarchical 
network analyzer" (see Claim 43) 
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"each of the collaborating nodes further includes a filter coupled between the 
packet source and the first hierarchical network analyzer ." (see Claim 44) 

"the first hierarchical network analyzers of each of the nodes feed information to 
a second hierarchical network analyzer ." (see Claim 45) 

"the information is used by the second hierarchical network analyzer to 
reconstruct the session utilizing the identified application ." (see Claim 46) 

"the information involves packet forwarding ." (see Claim 47) 

"the information involves hints and packet forwarding, the hints being generated 
by a lower level session analyzer and provided to a higher level analyzer to 
facilitate the reconstruction of the session ." (see Claim 48, as amended) 

"the information involves hints and a summary of packets, the hints being 
generated by a lower level session analyzer and provided to a higher level 
analyzer to facilitate the reconstruction of the session ." (see Claim 49 s as 
amended). 

Again, applicant respectfully asserts that at least the third element of the prima 
facie case of obviousness has not been met, since the prior art references, when 
combined, fail to teach or suggest all of the claim limitations, as noted above. A notice of 
allowance or a specific prior art showing of all of applicant's claim limitations, in 
combination with the remaining claim elements, is respectfully requested. 

An allowance is respectfully requested. 
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In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-5100. The 
Commissioner is hereby authorized lo charge any fees that may be due or credit any 
overpayment to Deposit Account No. 50-1351 (Order No. XACTP0I5B). 

R^^tfu/l^^^ftit^df 

Kevir^. Znkij/ ] 
P.O. Box 721120 Regi^r^nAIo. 41/429 

San Jose, CA 95172-1 120 / / / 

408-505-5100 1 / S 
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